CI supply chain: SCA, gitleaks, DinD TLS (#376) #380

New issue

Closed

opened 2026-06-13 07:56:27 +00:00 by PlasticDigits · 17 comments

PlasticDigits commented

2026-06-13 07:56:27 +00:00

(Migrated from gitlab.com)

Parent

Remediation bundle for #376 — Full security report.

Covers approved findings: H-06, M-11, M-13, L-12.

Current codebase

SCA gap (H-06 / L-12): .gitlab-ci.yml has two artifact build jobs only (qa-wasm-artifacts, qa-indexer-binary) — no cargo audit, cargo deny, or npm audit. frontend-dapp/package-lock.json has 23 advisories (2 critical, 10 high), including transitive elliptic via cosmjs/cosmes. Reference workflows in .github/workflows/ are not executed on GitLab.
DinD TLS (M-11): .gitlab-ci.yml L18–20 sets DOCKER_TLS_CERTDIR: "" and DOCKER_HOST: tcp://docker:2375 (unencrypted DinD).
Gitleaks (M-13): .githooks/pre-commit L48–56 skips gitleaks when binary not installed. No gitleaks job in CI. .gitleaks.toml exists with custom rules.

Why needed

Supply-chain vulnerabilities and secret leaks can reach default branch undetected. DinD without TLS allows co-process Docker control within the job pod. Approved scope: lightweight SCA, mandatory gitleaks in CI, enable DinD TLS.

Constraints / guardrails

H-06: Keep CI overhead low — prefer scheduled or change-gated jobs, --audit-level=high for npm, allowlist file for known accepted Rust advisories.
M-13: Gitleaks must never be optional in CI — pipeline fails on findings.
M-11: Enable DinD TLS (restore default DOCKER_TLS_CERTDIR) or document Kaniko migration; verify make build-optimized job still works.
L-12: Track cosmes/cosmjs upgrades for elliptic; document accepted risks where upgrades blocked.

Relevant files

Area	Paths
CI	`.gitlab-ci.yml`
Secrets scanning	`.gitleaks.toml`, `.githooks/pre-commit`
Rust deps	`smartcontracts/Cargo.lock`, `indexer/Cargo.lock`
Node deps	`frontend-dapp/package-lock.json`, `frontend-dapp/package.json`
Reference	`.github/workflows/` (not executed)
Docs	`docs/operator-secrets.md`, `gaps/GAP_1780200149.md`

Recommended direction

H-06 + L-12: Add CI stage security with:
- cargo audit --deny warnings (smartcontracts + indexer) with audit.toml allowlist for accepted findings.
- npm audit --audit-level=high --omit=dev in frontend-dapp (or full audit with documented dev-only exclusions).
- Run on default-branch pushes and MRs touching respective lockfiles; optional scheduled weekly job.
M-13: Add gitleaks detect --source . --verbose job using pinned gitleaks image; fail pipeline on any finding. Remove skip-if-missing behavior for CI (local pre-commit may remain best-effort).
M-11: Enable DinD TLS: remove DOCKER_TLS_CERTDIR: "", use DOCKER_HOST=tcp://docker:2376 with cert vars, or switch to Kaniko for wasm optimizer builds.

Acceptance criteria

GitLab CI runs cargo audit and npm audit on relevant changes; documented allowlist for false positives.
Gitleaks job mandatory on all default-branch pipelines; fails on secret patterns in .gitleaks.toml.
DinD uses TLS or alternative rootless build; qa-wasm-artifacts job green.
Dependency upgrade plan or accepted-risk doc for runtime elliptic transitive.

Test plan

Push branch with CI changes; verify all new jobs pass on clean tree.
Introduce dummy secret in test branch — gitleaks must fail (do not merge).
qa-wasm-artifacts manual CI_PIPELINE_SOURCE=web trigger — wasm artifacts produced.
Local: cargo audit, npm audit commands documented in docs/testing.md or CI README.

Attack / abuse test plan

Verify gitleaks catches patterns from .gitleaks.toml (test fixture file in scripts/ or temp commit on branch).
Confirm npm audit fails CI on new critical runtime advisory (dry-run with --audit-level=critical in test job).
DinD: document that TLS prevents sibling container Docker API access within job namespace.

Verification criteria

Pipeline green on main with new security stage.
No increase in median pipeline duration beyond agreed budget (document target, e.g. <5 min added).
gitleaks and audit jobs are rules: unconditional on default branch (not allow_failure: true).

## Parent Remediation bundle for [#376 — Full security report](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/376). Covers approved findings: **H-06**, **M-11**, **M-13**, **L-12**. ## Current codebase - **SCA gap (H-06 / L-12):** `.gitlab-ci.yml` has two artifact build jobs only (`qa-wasm-artifacts`, `qa-indexer-binary`) — no `cargo audit`, `cargo deny`, or `npm audit`. `frontend-dapp/package-lock.json` has 23 advisories (2 critical, 10 high), including transitive `elliptic` via cosmjs/cosmes. Reference workflows in `.github/workflows/` are not executed on GitLab. - **DinD TLS (M-11):** `.gitlab-ci.yml` L18–20 sets `DOCKER_TLS_CERTDIR: ""` and `DOCKER_HOST: tcp://docker:2375` (unencrypted DinD). - **Gitleaks (M-13):** `.githooks/pre-commit` L48–56 skips gitleaks when binary not installed. No gitleaks job in CI. `.gitleaks.toml` exists with custom rules. ## Why needed Supply-chain vulnerabilities and secret leaks can reach default branch undetected. DinD without TLS allows co-process Docker control within the job pod. Approved scope: lightweight SCA, mandatory gitleaks in CI, enable DinD TLS. ## Constraints / guardrails - **H-06:** Keep CI overhead **low** — prefer scheduled or change-gated jobs, `--audit-level=high` for npm, allowlist file for known accepted Rust advisories. - **M-13:** Gitleaks must **never** be optional in CI — pipeline fails on findings. - **M-11:** Enable DinD TLS (restore default `DOCKER_TLS_CERTDIR`) or document Kaniko migration; verify `make build-optimized` job still works. - **L-12:** Track cosmes/cosmjs upgrades for `elliptic`; document accepted risks where upgrades blocked. ## Relevant files | Area | Paths | |------|-------| | CI | `.gitlab-ci.yml` | | Secrets scanning | `.gitleaks.toml`, `.githooks/pre-commit` | | Rust deps | `smartcontracts/Cargo.lock`, `indexer/Cargo.lock` | | Node deps | `frontend-dapp/package-lock.json`, `frontend-dapp/package.json` | | Reference | `.github/workflows/` (not executed) | | Docs | `docs/operator-secrets.md`, `gaps/GAP_1780200149.md` | ## Recommended direction 1. **H-06 + L-12:** Add CI stage `security` with: - `cargo audit --deny warnings` (smartcontracts + indexer) with `audit.toml` allowlist for accepted findings. - `npm audit --audit-level=high --omit=dev` in `frontend-dapp` (or full audit with documented dev-only exclusions). - Run on default-branch pushes and MRs touching respective lockfiles; optional scheduled weekly job. 2. **M-13:** Add `gitleaks detect --source . --verbose` job using pinned `gitleaks` image; fail pipeline on any finding. Remove skip-if-missing behavior for CI (local pre-commit may remain best-effort). 3. **M-11:** Enable DinD TLS: remove `DOCKER_TLS_CERTDIR: ""`, use `DOCKER_HOST=tcp://docker:2376` with cert vars, or switch to Kaniko for wasm optimizer builds. ## Acceptance criteria - [ ] GitLab CI runs cargo audit and npm audit on relevant changes; documented allowlist for false positives. - [ ] Gitleaks job mandatory on all default-branch pipelines; fails on secret patterns in `.gitleaks.toml`. - [ ] DinD uses TLS or alternative rootless build; `qa-wasm-artifacts` job green. - [ ] Dependency upgrade plan or accepted-risk doc for runtime `elliptic` transitive. ## Test plan - Push branch with CI changes; verify all new jobs pass on clean tree. - Introduce dummy secret in test branch — gitleaks must fail (do not merge). - `qa-wasm-artifacts` manual `CI_PIPELINE_SOURCE=web` trigger — wasm artifacts produced. - Local: `cargo audit`, `npm audit` commands documented in `docs/testing.md` or CI README. ## Attack / abuse test plan - Verify gitleaks catches patterns from `.gitleaks.toml` (test fixture file in `scripts/` or temp commit on branch). - Confirm npm audit fails CI on new critical runtime advisory (dry-run with `--audit-level=critical` in test job). - DinD: document that TLS prevents sibling container Docker API access within job namespace. ## Verification criteria - Pipeline green on `main` with new security stage. - No increase in median pipeline duration beyond agreed budget (document target, e.g. <5 min added). - `gitleaks` and audit jobs are `rules:` unconditional on default branch (not `allow_failure: true`).

Rows
Columns